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(57) Methods and systems for preparing mail- 
pieces involve the creation of mailing lists 
which includes correct and incorrect recipient 
address information. The list is transmitted to a 
data center (116). Received from the data center 
(116) is a mailing list including addressed 
hygiened recipient address information and a 
digital token for each mail piece with encrypted 
data. The encrypted data is based on the correc- 
ted address information for mail pieces (122) 
with correct address information on the trans- 
mitted mailing list and on hygiened recipient 
address information on the maitpieces (122) 
with incorrect recipient address information on 
the transmitted mailing list The digital tokens 
for each mailpiece may also be based on the 
rating parameter information. 

Selection is provided for utilizing a given one 
of the incorrect recipient address information 
and the correct recipient address information is 
applied to an encrypter generating the digital 
tokens. The encrypting means for generating 
digital tokens may be located remote from the 
mailer facility or on a mailer facility or other 
local area network. Various arrangements are 
employed in generating and printing digital to- 
kens recipient address information and correc- 
ted recipient address information. 
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Field of the invention 

The present invention relates to value metering 
systems employing electronic data interchange and, 
more particularly to a postage evidencing system em- 
ploying electronic data interchange. 

Background of the Invention 

Postage metering systems have been developed 
which employ encrypted information printed on a 
mailpiece. The postage value for a mailpiece may be 
encrypted together with other data to generate a dig- 
ital token. A digital token is encrypted information that 
authenticates the information imprinted on a mail- 
piece including postal value. Examples of systems for 
generating and using digital tokens are described in 
U.S. Patent No. 4,757,537 for SYSTEM FOR DE- 
TECTING UNACCOUNTED FOR PRINTING IN A 
VALUE PRINTING SYSTEM; U.S. Patent No. 
4.831,555 for UNSECURED POSTAGE APPLYING 
SYSTEM; U.S. Patent No. 4,775,246 for SYSTEM 
FOR DETECTING UNACCOUNTED FOR PRINTING 
IN A VALUE PRINTING SYSTEM; U.S. Patent No. 
4,873,645 for SECURE POSTAGE DISPENSING 
SYSTEM; and, U.S. Patent No. 4,725,718 for POST- 
AGE AND MAILING INFORMATION APPLYING SYS- 
TEM. The entire disclosure of these five patents is 
hereby incorporated by reference. 

As a result of the digital token incorporating en- 
crypted value, such as postage value, altering the 
printed information in a Postal Revenue Block is de- 
tectable by standard verification procedures. 

It has been recognized that to underpay postage, 
an attempt may be made to interfere with the rating 
process (as opposed to the resulting printed postage 
value). Systems have been developed to protect 
against such attempts by the use of hash values and 
encrypted hash values of various rating parameters 
and rate tables such as is disclosed in U.S. Patent Ap- 
plication Serial No. 133,398 filed October 8, 1993, for 
POSTAL RATING SYSTEM WITH VERIFIABLE IN- 
TEGRITY by Leon A. Pintsov, Richard A. Connell, Ro- 
nald P. Sansone, and Alfred C. Schmidt and assigned 
to Pitney Bowes Inc. (EP application 94307376.7). 

In U.S. Patent No. 4,873,645 for SECURE POST- 
AGE DISPENSING SYSTEM and U.S. Patent No. 
4,725,718 for POSTAGE AND MAILING INFORMA- 
TION APPLYING SYSTEM, as well as published 
French Patent Application 90 01284 (Publication No. 
2 657 985) for PROCESS AND INSTALLATION FOR 
CONTROLLING THE COMPUTERIZED POSTAL 
METERING OF LETTERS; it has been disclosed that 
addressee information can be beneficially utilized as 
part of the encryption process to provide enhanced 
security against counterfeiting of the printed digital 
token since the encrypted information is unique to 
each address. 



Summary of the Invention 

It has been discovered that a value metering sys- 
tem can be provided which employs encryption but 

5 has a greater security than heretofore obtainable by 
prior systems. 

It has been further discovered that it is possible 
to provide a digital token for use in imprinting on a 
mailpiece or other item where neither the secret key 

10 nor a secret algorithm is available at the mailer print- 
ing device or at the mailers site. 

It has been further discovered that a large num- 
ber of mailers can be supported in an encryption sys- 
tem with enhanced key management in a simple and 

15 effective manner. 

The present invention further facilitates the utili- 
zation of address information which may or may not 
be subject to address hygiene at either the mailer's lo- 
cation or a remote location or on a network. 

20 In accordance with the present invention, meth- 

ods and systems for preparing mail pieces are em- 
ployed. A mail list is created including mailpiece reci- 
pient address information for each mailpiece. The 
mailing lists includes correct recipient address infor- 

25 mation and incorrect recipient address information. 
The mailing list is transmitted to a data center. Re- 
ceived from the data center is a mailing list including 
hygiened recipient address information for mail pieces 
in the transmitted mailing list with incorrect recipient 

30 address information. Additionally received are digital 
tokens for each mailpiece. Each of the digital tokens 
includes encrypted information for each mailpiece 
based on the correct address information for mail- 
pieces with correct address information on the trans- 

35 mitted mailing list and on hygiened recipient address 
information for mail pieces with incorrect recipient ad- 
dress information on the transmitted mailing list. 

Preferably, rating parameter information is deter- 
mined for each mailpiece. The rating parameter infor- 

40 mation constitutes the basis upon which the charges 
for mailpiece delivery is calculated. The rating para- 
meter information is transmitted to the data center 
and the received digital token for each mailpiece are 
based, in addition to the recipient address information 

45 on the rating parameter information. 

Preferably, recipient address information is gen- 
erated for mailpieces. The recipient address informa- 
tion includes correct and incorrect recipient informa- 
tion. Correct recipient information is generated for in- 

so correct recipient information and a selected one of the 
incorrect recipient address information and the cor- 
rected recipient address information is applied to an 
encrypter. The encrypter generates encrypted data 
based on the selected one of the incorrect recipient 

55 address information and the correct recipient address 
information. The encrypted data then may be placed 
on the mailpiece. 

Preferably, recipient address information is com- 



BNSDOCIQ <EP 0663652A2_I_> 



3 



EP 0 663 652 A2 



4 



municated from the mailers facility to a means for en- 
crypting. The means for encrypting is located remote 
from the mailer facility and contains encryption algo- 
rithm information. Encrypted data is generated by the 
remote encryption means based on the communicat- 
ed recipient information and the encryption algorithm 
information. The encrypted data is transmitted from 
the remote encryption means to the mailer facility. 
The mailer facility does not have access to the en- 
cryption algorithm information. 

The encryption algorithm noted above may or 
may not be known; however, secret encryption key in- 
formation is incorporated in the remote encryption 
means and the mailer facility does not have access 
to this secret encryption key information. 

A digital token may be generated based on both 
recipient address information and corrected recipient 
address information. The digital token is imprinted on 
the mailpiece such that a relationship exists between 
the selected one of the recipient address information 
and the corrected recipient address information and 
the printed digital token. 

Both digital tokens may be printed on the mail- 
piece along with the selected one of the recipient ad- 
dress information and the corrected recipient address 
information. 

Recipient address information may be communi- 
cated from a first location at a mailers facility over a 
local area network to means for encrypting at a sec- 
ond location at the mailer facility. The encrypting 
means is protected by a tamper resistant housing and 
coupled to the local area network. The encrypting 
means contains encryption algorithm information. 
The encryption means generates encrypted data 
based on the communicated recipient information and 
the encryption algorithm information. The encrypted 
data is transmitted from the encryption means over 
the local area network to the mailer facility first loca- 
tion. If desired the encrypted data may be placed on 
the mailpiece at the mailer facility. 

The encryption algorithm information may or may 
not be a publicly known encryption algorithm; how- 
ever, the means for encryption contains secret en- 
cryption key information. 

Brief Summary of the Drawings 

Reference is now made to the following FIG- 
URES wherein like reference numerals designate 
similar elements in the various views, and in which: 
FIGURE 1 is a block diagram of a postage evi- 
dencing system architecture embodying the 
present invention; 

FIGURE 2 is a block diagram of a communica- 
tions arrangement involving a data center, a cen- 
tral post off ice and regional data centers and post 
offices suitable for use with the architecture dis- 
closed in FIGURE 1; 



FIGURE 3 is a diagrammatic representation of 
the mailer unit postage evidencing system; 
FIGURE 4 is a diagrammatic representation of a 
data center adapted to interact with the mailer 
5 unit shown in FIGURE 3; 

FIGURE 5 is a diagrammatic representation of a 
carrier verification system adapted to verify post- 
age payment evidenced in accordance with the 
present invention; 
10 FIGURE 6 is flow chart of the operation of the 

mailer unit shown in FIGURE 3; 
FIGURE 7 is flow chart of the operation of the 
data center shown in FIGURE 4; 
FIGURE 8 is a flow chart of the verification proo- 
fs ess for the verification authority system shown in 
FIGURE 5; 

FIGURE 9 is an architecture of an alternate em- 
bodiment of the metering system shown in FIG- 
URE 1 suitable for use in a network environment; 
20 FIGURE 10 is a diagrammatic representation of 

a mailer unit coupled to a network system along 
with other necessary components for metering 
postage; 

FIGURE 11 is a diagrammatic representation of a 
25 data center suitable for operation with the mailer 

unit and network arrangement shown in FIGURE 
10; 

FIGURE 12 is a diagrammatic representation of 
a post office for verification of mail pieces suit- 
30 able for use with the network arrangement shown 

in FIGURES 10 and 11; 

FIGURE 13 is a flow chart of the mailer and net- 
work arrangement shown in FIGURE 10; 
FIGURE 14 is a flow chart of the network postage 
35 evidencing device system for the network server 

shown as part of FIGURE 10. 

Detailed Description of the Preferred 
Embodiment 

40 

Reference is now made to FIGURE 1 . A mailer 
unit shown generally at 112 is utilized to generate 
mail pieces including suitable postage revenue blocks 
including necessary information to mail the letters to 

45 various addresses. The mailer unit 112 includes data 
necessary to process mail including mailing list infor- 
mation, rating information, mailer authentication 
code information and account data information which 
is stored in a storage device 115. The mailer unit func- 

so tions to create a mailing list, determine rating parame- 
ters which are used to establish the postal value to be 
imprinted on a mailpiece and encrypt and send to a 
data center the necessary information via electronic 
data interchange over communication link 118. The 

55 mailer unit also receives the processed information 
necessary to prepare mailpieces and produces the 
mailpiece for dispatch into the mail stream. 

The mailing list includes recipient address infor- 
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mation. This recipient address information may in- 
clude both correct and incorrect information. The na- 
ture of the incorrect information may be incomplete or 
inaccurate addressee data. For example, as noted 
below address hygiene may be employed. In such s 
case, a determination that the address on the mailing 
list does not correspond to an address in the hygiene 
data base, the recipient addressee information would 
be deemed incorrect. These databases include a 
compilation of all address for a given region, area or 10 
even an entire country. The United States Postal Ser- 
vice National Address Database is one example of 
this type of database. It should be recognized that in 
many instances incorrect address information does 
not render a mailpiece undeliverable as addressed. 15 
For example, a street name may be misspelled or a 
zip code may be omitted or a "vanity" name or abbre- 
viation may be used for a city. 

Communication is encrypted to prevent eaves- 
dropping on the communication link. A shared piece 20 
of secret data such as the mailer authentication code 
may be communicated in encrypted form to verify the 
authenticity of the mailer and likewise to verify the 
authenticity of the data center shown generally at 116. 
It should be expressly recognized that many varia- 25 
tions of the communications system and data flow 
can be established. For example, the carrier may es- 
tablish a private Electronic Data Interchange stan- 
dard or may work through the ANSI X.12 or EDIFACT 
standards committees. Moreover, various communi- 30 
cations means could be employed including dial up 
modems, packet switched networks or interactive tel- 
evision networks. 

It should also be recognized that the communica- 
tions system may employ paper based transactions. 35 
For example, the mailer may provide a printed mail list 
to the data center for processing and the data center 
may provide printed labels containing valid Postal 
Revenue blocks. 

The data center 116 stores mailer account data, 40 
vendor secret keys for generating digital tokens and 
also a postal data base, which is a data base of valid 
addresses utilized in address hygiene activity. A 
change of address data base may also be included to 
correct address changes which may not be known to 45 
the mailer unit 112 as well as a data repository. 

The data repository is provided at the data center 
to store statistical data concerning the mailer, such as 
total postage utilized, piece count of mail items, 
groupings of letters sent to various zip codes, classes so 
of mail service utilized and other useful data. This in- 
formation is stored in a memory storage device 110 
located at the data center. The data center provides 
the functionality of cleansing the mail list (address hy- 
giene) and generating a postal revenue block (PRB) 55 
file. The PRB represents the information to be printed 
as the postal revenue block on each mailpiece by the 
mailer unit 112. It updates the data repository stored 



in the storage device 110 as additional data is re- 
ceived from the mailer unit 112 and transmitted back 
to the mailer unit. The data center 116 further func- 
tions to collect funds and pay postage and to maintain 
the updated data repository for later utilization. 

The data center 11 6 is in communication via elec- 
tronic data interchange (EDI) communication link 1 1 3. 
Similar to communication over the EDI link 118 be- 
tween the mailer unit 1 1 2 and the data center 1 1 6, se- 
crecy and authenticity techniques may be implement- 
ed. In the case of the mailer unit 112 and the data cen- 
ter 116 the shared secret data may be a mailer au- 
thentication code which is stored in the data center as 
part of the mailer account data. The shared informa- 
tion between the data center 116 and the postal office 
data center 114 may be a vendor authentication code 
which would be stored as part of the data repository 
at the data center and also as part of the data repo- 
sitory at the post office 114. 

At the post office 114, a postal data base is main- 
tained as is address and a change of address data 
base. Additionally, a data repository and postal secret 
keys are stored. This information is stored in a storage 
device 120. The post office 114 functions to scan and 
verify the postage revenue block 124 of mailpiece 
122 which is physically transmitted from the mailer 
unit to the post office or to another verifying facility 
which, for example, may be a contracted facility. Al- 
ternatively, postal revenue blocks may be inspected 
in the field by postal or other inspectors employing 
suitable equipment. The post office 114 also main- 
tains and updates the data base of addresses and 
maintains and updates the data repository. The de- 
tailed operation of each of these facilities, the mailer 
unit 112 the data center 116 and the post office 114 
is described in detail in connection with both the dia- 
grammatic representation of each of these facilities 
and their accompanying flow charts. 

The postal revenue block 124 as well as the im- 
printed recipient address information 123 may be 
printed in machine readable form. This may be as 
shown at 123 A as part of the imprinted recipient ad- 
dress information block on the mailpiece 1 22 or at any 
selected separate location on the mailpiece (which 
may be as part of the postal revenue block 124 or 
elsewhere as shown 123B). The particular and ma- 
chine readable imprint of the postal revenue block 
124 and/or recipient address information 123 is 
shown as imprinted in bar, half bar code. Other ma- 
chine readable alpha numeric fonts are suitable for 
imprinting on the mailpiece 122. 

Reference is now made to FIGURE 2. The main 
data center of the vendor 202 is connected via a com- 
munication link 204 to the central post office 206. The 
main vendor data center 202 is also connected 
through communication links 208 to various regional 
data centers shown generally at 210. The regional 
data centers 210 are connected in turn to various mai- 
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lers shown at 212, 214 and 216. The central post of- 
fice 206, similar to the main data center of the vendor 
202, is connected via communication links to regional 
post offices shown generally at 220. It should be not- 
ed that the regional data center 220 may be in com- s 
municatton via a data link 222 to the regional post of- 
fices 210 and the various mailers 212, 214 and 216. 
Physically transmission of mail pieces to the regional 
post offices 220 as is shown by the dashed lines 224, 
226 and 228. The mailers 212, 214 and 216 are in 10 
communication with the regional data centers via 
communication links 213, 215 and 217. 

It should be expressly recognized that many va- 
riations of the communications system and data flows 
can be established. For example, the mailers 212, 15 
214 and 216 can send their mail pieces directly to the 
central post office 206. Moreover, the mailers can be 
in direct communication with the main data center 
202. Other combinations and variations are possible 
depending on the needs of the particular postal envir- 20 
onment involved. 

Reference is now made to FIGURE 3. The mailer 
unit shown generally at 302 includes a printer 304 and 
optionally a scale 306. The printer 304 is connected 
through a print communication port 308 to the printing 25 
control system 310. Printing control system is adapt- 
ed to control the operation of the printer 304. The op- 
tional scale 306 is connected to a scale port 312 of the 
rating parameter system 314. This system 314 pro- 
vides the ability to rate the mailpieces based on ac- 30 
tual rate and/or other rating parameters measurable 
by the scale 306 and or associated apparatus. 

Alternatively, for a mailing to be implemented, the 
rating parameter system 314 can, based on various 
information in the mailer unit computer storage 316, 35 
determine the rating parameters to be utilized 
through a rating process 319. This is based on infor- 
mation stored on the rating parameter system 314. 
The mailing unit storage device 316 is in communica- 
tions with a data communications system 318 to en- 40 
able communications with a remote data center to be 
hereinafter described. A data communications sys- 
tem 318 includes a communication port 320 to facili- 
tate the communications. A user interface 322 can be 
by means of I/O a communication input/output (I/O) 45 
port 324, or by a keyboard and display, by other I/O 
type devices or by means of a smart card or magnetic 
card. A secret mailer authentication code is stored in 
a secure tamper resistant device 326. The authoriza- 
tion code can alternatively be secret information so 
known to the mailer and hand keyed into the system 
using the user interface 322. The authorization code 
is then passed to the data communications system 
318 to initiate a mail run in accordance with the flow 
chart described hereinafter. 55 

The mailer authentication code is not part of the 
security of the mailing process but is part of the 
shared information communicated over the EDI chan- 



nel 1 1 8 of FIGURE 1 between the mailer 112 and the 
data center 116. The mailer authentication code pro- 
vides for mutual security and authentication for the 
mailer and the data center. It is not related to security 
of the postal funds or to the information imprinted on 
each mailpiece. Mailer account data received from 
the data center and stored in the storage device 316 
can be sent to the printing control system for gener- 
ation of incoming reports. 

The printer 304 and the printing subsystem 310 
as well as other areas of the mailer unit 310 and other 
portions of the system outside of the mailer unit may 
be monitored to ensure proper operation. Specifical- 
ly, as an example, if the printer 304 should not prop- 
erly print digital tokens (the postal revenue block 124 
on mailpiece 122 this information is detected and 
stored in the mailer unit for communication to the data 
center to enable credit to be provided to the mailers 
account, and/or to initiate an inspection if warranted 
based on the number of digital tokens that are not 
properly printed. The failure to print the digital token 
by printer 304 may be due to a failure of the printer, 
and a failure in the communications channel, or a spe- 
cif ic determination on the part of the mailer not to pre- 
pare the particular mailpiece. In any event, once the 
digital token, as will be recognized hereafter, has 
been issued by the data center to the mailer, the mai- 
lers account may be charged for such digital token 
and audit of receipt and use of the digital token is re- 
quired for the mailer to ensure that no charge is incur- 
red for a digital token not utilized, unless such ar- 
rangement is part of the system and understanding 
between the mailer and the carrier involved. 

Reference is now made to FIGURE 4. The mailer 
unit communicates to the data center shown generally 
at 402 via a data center communications port 404 
which is part of the data communications system 406. 
The data communications system 406 further in- 
cludes a data communications port 408 adapted to in- 
terface to the Post Office. 

The data communications system 406 is connect- 
ed to a data storage device 410 which includes vari- 
ous information in addition to information received 
from the mailer. Included in the storage device 410 
are: postal address database; a national change of 
address database; a data repository which would in- 
clude information transmitted by the mailer, and, mai- 
ler account information which also would include in- 
formation transmitted by the mailer. The data reposi- 
tory and mailer account information may include ac- 
cumulated data and other data stored by the data cen- 
ter relevant to various transactions associated with 
the mailer. 

A secure tamper resistant memory 412 is provid- 
ed at the data center. The data center secure memory 
412 may be a part of the memory 410 or a separate 
independent memory system. The memory 412 
stores various information which need to be main- 
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tained secure, including the vendor authentication 
code, the mailers authentication codes, the vendor 
secret key information, if desired, and the digital tok- 
en transformation algorithm. The data from the mem- 
ory 412, appropriate data from memory 41 0, data re- 
ceived from the mailer via data communications sys- 
tem 406, along with data from the postal rating sys- 
tem 418, are processed in a digital token transforma- 
tion device 414 to produce the vendor digital token. 
For maximum security the Post Office digital token is 
produced by a digital token transformation performed 
securely within the Post Office security device 420. 
The digital tokens authenticate a mailpiece and the 
postage value imprinted on said mailpiece. The data 
used to produce the vendor digital token is also used 
to produce the Post Office digital token. Said data is 
transmitted to the Post Office security device 420 via 
the Postal security interface 416. The Post Office se- 
curity device produces the Post Office digital tokens 
via a digital token transformation and returns them to 
the data center via the postal security interface. The 
Post Office security device may be located in the data 
center and it contains the Post Office secret keys that 
are assigned by the Post Office to the data center for 
production of digital tokens. Alternatively, the Post 
Office secret keys may be stored in the data center 
secure storage device 412 and the Post Office digital 
token transformation may be performed in the digital 
token transformation device 414. In this case the se- 
curity of the system is reduced, because the vendor 
and Post Office secret information is not kept sepa- 
rate. . 

The payment for postage is transferred from the 
mailers account to the postal service at the data cen- 
ter electronic funds system 422. 

The Post Office security device 420 has the post 
office secret key information which is used by the dig- 
ital token transformation process 414 to generate 
post office digital tokens. These post office digital tok- 
ens are also transmitted (along with the vendor digital 
tokens) to the mailer via communication port 404. The 
operation of the data center components are descri- 
bed in greater detail in connection with the associated 
flow chart 

Reference is now made to FIGURE 5. A Post Of- 
fice shown generally at 502 receives physical delivery 
of various mailpieces 122, each including both digital 
tokens printed in the postal revenue block 124. The in- 
formation from the mailpiece 122 is obtained at de- 
vice 504 by OCR recognition, voice input or manual 
key entry by a Post Office employee or by other suit- 
able manner such as video lift image technology. 

The information from the device 504 is commu- 
nicated through a communication port 506 which is 
part of the data communications system 510. The in- 
formation capturing device 504 is utilized in conjunc- 
tion with information stored in a post office data stor- 
age device 512 to verify the postal revenue block 124 



by utilization of the Digital Token Transformation 
process 514. The postal secret key information and 
other relevant secret postal information may be stor- 
ed in a secure tamper resistant storage device 516. 

5 The vendor authentication codes are also stored in 
the secure storage device 516. 

The storage device 512 includes: postal address 
database; national change of address database; 
postal rate database; data repository; and, verifica- 

w tion reports. Other suitable information may be stored 
in this memory. An electronic funds system 518 is 
provided to receive funds from the data center via the 
data communication system 51 0 as part of an elec- 
tronic funds transfer system. It should be noted that 

15 various suitable funds transfer system may be em- 
ployed as part of the present invention. 

The data center 402 may communicate to the 
Post Office 502 both data repository information and 
verification report information to allow the Post Office 

20 502 to be periodically updated as to this information. 
Similarly, the post off ice 502 may periodically update 
the data center, 402. 

It should be expressly noted that the system de- 
scribed is a system where secure postal key and se- 

25 cure vendor key and secure postal algorithm and se- 
cure vendor algorithm information may all be em- 
ployed, and not stored at the mailer unit site 302. This 
provides greatly enhanced security because access 
to information which could allow the fraudulent gen- 

30 eration of digital tokens is completely. While the mai- 
lers may be hundreds and thousands in number, the 
number of vendors and the number of post office data 
centers requiring this information is limited in number 
allowing a much higher security and control to exist 

35 for this critical data. 

Reference is now made to FIGURE 6 which is the 
flow chart of the operation of the mailer unit shown in 
FIGURE 3. And, more particularly, the process 
wherein the mailer postage request is initiated and 

40 the Digital Tokens received and utilized in printing the 
postage revenue block. 

At 602 a determined postage request is initiated 
and certain particular parameters associated with the 
process are either switched to an active or inactive 

45 state. Specifically, at 602 a determination is made by 
the user whether address hygiene is to be performed. 
The address information may not be susceptible to 
address hygiene due to either a lack of appropriate 
address information or due to mailer's desire to keep 

so due address information in its original uncorrected 
form. If the address hygiene parameter switch is ac- 
tuated, a further parameter switch is available to de- 
termine whether the system is to use any corrected 
hygiened address (that is a changed address) as op- 

55 posed to the original address in generating the digital 
token to be imprinted on the mailpiece. This parame- 
ter switch is utilized so that a user has the option of 
using the uncorrected address for a particular mail- 
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piece but still be advised of the fact that the address 
hygiened data base carries with it a different hygi- 
ened address. 

This is a very essential feature for a mailer to be 
able to determine which address is utilized in gener- 
ating the digital token. Assurance must be had that 
the digital token generated with the address informa- 
tion corresponds with the address printed on the en- 
velopes. Thus, if the hygiened address is to be printed 
on the envelope the corrected address would be used 
in the generation of the digital token. On the other 
hand, if the uncorrected address is utilized then the 
uncorrected address is also utilized in generating the 
digital token. This allows later verification from the 
mailpiece itself. Moreover, from time to time address 
hygiened data bases themselves have incorrect infor- 
mation such that the hygiened address could change 
a correct address to an incorrect address. Thus, this 
option is needed at least for this purpose. Address hy- 
giene may involve multiple communications between 
the mailer and the address hygiene data base. If the 
data base is located remotely and communication 
costs are involved, It may be desirable to automate 
the use of the particular address (corrected or uncor- 
rected hygiened address) determined on the number 
of times communications are necessary to correct the 
address. Thus, if a corrected address comes back in 
a first communication pass this address may be used 
while if the first communication pass results in a re- 
quest for further information from the user to enable 
address hygiene to proceed, the uncorrected address 
will be utilized in generating Digital Tokens. This al- 
lows the mailer to generate all of the Digital Tokens for 
a large number of mail pieces which may be process- 
ed in a single time in one communication pass without 
the necessity to delay processing of the entire group 
of mail pieces until multiple communications with the 
address hygiened data base is completed or alterna- 
tively to defer the processing of the particular mail- 
pieces requiring multiple communications. 

Alternatively, uncorrected address can be out- 
sorted from a mail run so that all uncorrected ad- 
dressed mail can be later processed, possibly as a 
separate batch with or without address correction. 

For those rating systems that provide a discount 
for hygiened addresses, it may be necessary for 
those unhygiened addresses (where uncorrected ad- 
dresses or incomplete addresses are utilized) to pay 
an additional postage amount Thus, the system must 
provide postage value to be imprinted by hygiened 
and unhygiened address as appropriate. An example, 
of an unhygiened address in the United States is 
where certain "vanity" names are used as opposed to 
standard names stored in the postal address data 
base. 

In areas where uncorrected addresses are util- 
ized, it may be desirable to utilize an address identi- 
fier. This is a delivery address identifier to provide a 



unique addressee number associated with a particu- 
lar mailpiece (this may also be utilized in connection 
with hygiened addresses) which can be a numeric or 
alphanumeric string associated with the address. The 

5 string is derived algorithmically from the data in the 
delivery address block. It should be such that it is dif- 
ficult to produce two different address blocks that 
have the same delivery address identifier. A Delivery 
Point Postal Code (such as a zip code in the United 

10 States which may involve up to 11 digits) is an exam- 
ple of a delivery address identifier. 

At 604 a determination is made if there is another 
mailpiece for which a postage request is required. If 
this is true (as it would be for the first postage request 

is received) the mailer at 606 generates the address for 
the mailpiece (which may be hygiened or unhygi- 
ened) and the various rating parameters as well as 
the date of entry into the mailstream (the date in 
which the mail will be deposited with the carrier). 

20 Other dates of entry can be used depending upon the 
nature of the system involved such as the date of cre- 
ation of the mailpiece. The rating parameters can 
vary depending upon the particular rating system as- 
sociated with the carrier involved. The rating systems 

25 vary from carrier to carrier, as for example the United 
States Postal Service, United Parcel Service, Federal 
Express, United Kingdom Royal Mail, etc. These ser- 
vices have various rating parameters utilized to deter- 
mine the appropriate price for a delivery of a particu- 

30 lar mailpiece (which for the purpose of the present in- 
vention and disclosure is intended to include parcels). 
At 606 the processing of a particular mailpiece is ac- 
tivated by generating various information elements 
that may include the address, rating parameters, date 

35 of entry. This may be appended to a postal request 
file which is being generated as various mailpieces 
loop through decision block 604 and are processed at 
606. Where no further mailpieces are to be processed 
as determined at 604, communications is established 

40 with a remote data center at 608. 

A procedure is initiated and completed at 610 to 
authenticate the data center in a known manner such 
that the mailer is assured that communication has 
been established with an authorized data center to is- 

45 sue the digital tokens to be printed on the mailpieces. 
Once this has been established, the postal request 
file may be encrypted at 61 2 and the encrypted postal 
data file transmitted at 614 to the data center. The 
data center at 61 6 performs its process on the trans- 

50 mitted encrypted postal request file as shown in de- 
tail in FIGURE 7. This process at the data center 
which is shown in abbreviated form at block 616 and 
involves: generating (if a hygiened request has been 
made) a bad address file; a corrected address file; a 

55 postal revenue block file (with a postal revenue block 
associated with each of the plurality of mailpieces in- 
volved in the transmitted encrypted postal request 
file); and, an accounting record of the transaction 

7 ' 
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which debits funds associated with the mailer's ac- 
count for the digital tokens to be transmitted to the 
mailer. At 616 the data center encrypts (some or all) 
of the above noted files, namely, the bad address file, 
corrected address file, postage revenue block file 
and accounting record, and sends these files or por- 
tions thereof to the mailer. 

At 618 the mailer receives the encrypted files 
transmitted by the data center and decrypts these 
files or portions thereof depending upon the particu- 
lar system implemented and the nature of the data 
transmitted. For each address for a given postal re- 
quest file that has been transmitted, processed and 
received back, if for such item there is an exact match 
as to the address at 620, a determination is made at 
622 whether this address is in the postal revenue 
block file. In such case, the data is formatted at 624 
and an envelope is printed at 626 with the postal rev- 
enue block. Other appropriate data may also be print- 
ed at 626 such as the address, barcode, return ad- 
dress and advertising slogan, unique identifiers as- 
sociated with advertising material or surveys, service 
codes and the like. 

If on the other hand the address is not in the post- 
al revenue block file, for whatever reason, which 
would most likely be an error condition, the mail piece 
is not generated at 628. The process loops back to de- 
cision block 620 and continues as to the next mail- 
piece. 

The error condition noted above at 628 is only 
one example of many error conditions that can exist 
throughout the system which would require corrective 
action. Another example is the postage revenue block 
file being out of synchronism with the postal request 
file. This could have occurred because of a process- 
ing error or a communication error or a component 
failure. Other errors can occur throughout the system 
which will require similar type corrective action as 
noted in block 628, or if needed or desired, to com- 
pletely halt the process, to resynchronize the relation- 
ship of the various data files, and/or to reinitiate the 
process from the beginning. Because of the fact that 
funds may be accounted for where printing has not 
taken place, it is important that this information be 
communicated back to the data center 402 to allow 
either an electronic or physical audit to be conducted 
to determine the nature and extent of the error for 
which refunded postage may be requested. 

If at 620 if there is no exact match for the partic- 
ular mail piece from the decrypted postal request file 
with the address in the mailers generated postal re- 
quest file transmitted to the data center, a determina- 
tion is made at 630 if the address was corrected. If the 
address was corrected a further determination is 
made at 632 whether to accept the corrected address 
and if so the mailers address data base is updated at 
634 and the process continues to decision block 622 
as previously noted. 



If on the other hand the address was not correct- 
ed as determined at 630, the correct current address 
is generated at 636 if possible. This may be a manual 
update or loading in of new address from another 

5 source. The inability to correct a bad address will flow 
through, to block 628 and result in not generating the 
particular mailpiece. At 638 the corrected address 
from 636 is used to update the mailers address data 
base and the process continues to decision block 

10 622. 

Various software is suitable for use in the above 
process. One example is the AddressRight software 
marketed by Pitney Bowes. Another example is the 
software program entitled Dazzle marketed by Envel- 

15 ope Manager Software. DAZzJe Version 2.0, Copy- 
right 1992-1993, Envelope Manager Software, 247 
High Street, Palo Alto, CA 94301-1041. This Micro- 
soft Windows based program deals with completing 
envelope layout and printing including address verifi- 

20 cation and barcode printing including barcode for the 
gateway for airport locations for overseas mail. 

It should also be recognized that the present sys- 
tem described above maybe integrated with a plural- 
ity of different carriers such that in a single commu- 

25 nications process tokens can be received and sepa- 
rately sorted for various carriers such as the United 
States Parcel Service, Federal Express, the United 
States Postal Service, United Kingdom Royal Mail, 
DHL and Airborne and the like. Moreover, the data 

30 center providing the digital tokens may process the 
request to identify the most suitable service to meet 
the requirements of the mailer. This may be based on 
mailing cost delivery time, mail or parcel type or size, 
destination being served, insurance and the like. 

35 Reference is now made to FIGURE 7 which is a 

flow chart of the operation of the data center shown 
in FIGURE 4. At 702 a request is received to authen- 
ticate a mailer. The authentication process ensures 
that the data center is in communication with a spe- 

40 cif ic known mailer and uses conventional techniques 
to authenticate the party with whom the data center 
is communicating. The data center then receives and 
decrypts the postal request file at 704 and a determi- 
nation is then made at 706 if there is an unprocessed 

45 record in the postal request file. If so, a decision is 
then made at 708 if the address hygiene has been re- 
quested by the mailer. If so, address hygiene is per- 
formed at 71 0 and thereafter a determination is made 
at 712 if an exact match was found for the particular 

so record in the file being processed. If this occurs, the 
data center at 714 appends the record to the postal 
revenue block file that an exact match was found in 
the process and loops back to decision block 706 to 
process the next record. The process continues again 

55 at block 708 and if, for example, the next record is a 
record where address hygiene has not been request- 
ed the flag indicates that fact would be appended to 
the record in the postal revenue block file. The entire 

8 
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record may be appended to the record in the postal 
revenue block file using the address as provided by 
the mailer at block 714. 

If at block 712 an exact match was not found as 
part of the address hygiene process, a determination 
is made at 71 6 whether the address was corrected as 
part of the address hygiene process at 710. If this is 
true, the indication of this fact is appended to the cor- 
rected address file at 718. A further determination is 
made at 720 whether the mailer has requested to use 
the corrected address in generating the digital token. 
If so, at 722 the corrected address record is appended 
to the postal revenue block file. If on the other hand, 
the mailer had determined at 720 not to use the cor- 
rected address file, the postal request file is append- 
ed to the postal revenue block file at 724 to be used 
in the generation of the digital tokens. 

If at 71 6 if the address was not corrected, the re- 
cord is appended to the bad address file at 726 and 
no digital token will be generated for this address. 
Thus, if address hygiene was requested by the mailer 
and the data center was unable to correct address hy- 
giene and conduct the particular address involved, no 
digital token is generated. This fact is noted in the bad 
address file for later action by the mailer and no funds 
are withdrawn for this particular mail piece. After de- 
cision block 76 determines that there are no further 
unprocessed records in the postal request file, the 
process continues to proceed to generate digital tok- 
ens. 

At 728 a determination is made if there is a record 
to process in the postage revenue block file. If this is 
true, a delivery point postal code is generated at 730. 
In the United States this delivery point postal code is 
the 11 digit code. Specifically, it is a unique address 
identifier. The delivery point postal code is an identi- 
fier which is unique to each address and as noted 
above is an example of a delivery address identifier. 
If the delivery point postal code is successfully gen- 
erated as determined at 732, the rating process is 
performed at 734. This generates the proper required 
amount of postage for the mail piece involved. An ex- 
ample of the type of rating process and procedure 
which could be used is described in the above- 
identified pending U.S. Patent Application for POST- 
AL RATING SYSTEM WITH VERIFIABLE INTEGRI- 
TY. Other forms of rating processes may also be suit- 
ably employed. If at 732 a delivery point postal code 
has not been successfully generated, at 736 a deliv- 
ery address identifier is generated and thereafter the 
rating process proceeds at 734. 

At 738 an assembly is made of the digital token 
transformation input data which may include the post- 
age amount; the date of submission; delivery address 
identifier or delivery point postal code as the case 
may be; piece count; mailer identification data; and, 
origination identifier (such as origination zip code). 

The generation of a digital token can use many 
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different forms of input data to create a digital token 
to ultimately be printed on a mailpiece. The particular 
organization and nature of the input data and the 
transformation involved is a matter of the require- 

5 ments of the mailer, the carrier and the level of secur- 
ity desired. At 740 the digital token transformation is 
performed to generate the vendor digital token and at 
742 the postal service digital token transformation is 
performed to generate the postal service or carrier 

10 service digital token. 

The digital token transformation at 742 is a sec- 
ond digital token transformation. This digital token 
transformation utilizes the postal service or courier 
service black box at the data center (see block 420 in 

15 FIGURE 4) . Moreover, the transformation process 
and the algorithms involved can be different in the 
transformations at 740 and 742. Each is separately 
selected. The vendor selects the particular transfor- 
mation at 740 subject to various regulations of the 

20 carrier service. The carrier selects the transformation 
of 742 to meet its requirements. At the data center, 
because of the security of the postage security device 
420 which is not accessible to data center personnel 
or only to limited authorized data center personnel, 

25 the vendor has the ability to generate the postal ser- 
vice or carrier digital token without knowing the pre- 
cise transformation involved. 

An error control code is generated at 744 and ap- 
pended to the string of data. This is provided to effec- 

30 tuate high speed accurate automatic data capture, 
and processing where error control codes are normal- 
ly employed to detect and correct the corruption of 
data. The error control code is utilized at later date 
when scanning the string of data to ensure the data 

35 has been scanned properly or keyed in properly. It is 
used in standard fashion to verify the integrity of the 
process of the data entry. The data center at 746 ac- 
counts for the postage and generates accounting re- 
cord and charges the postage to the mailers account. 

40 This may also involve the transfer of funds from one 
account to another account such as from the mailers 
account to the carriers account, or through intermedi- 
ary accounts such as a trustee account to the carrier 
account. At 748 the postal revenue block file is ap- 

45 pended to it include the following data: the postage 
date of submission; delivery address identifier or de- 
livery point postal code, as the case may be; piece 
count mailer identifier, origination zip code; vendor 
digital token; postal service and/or carrier digital tok- 

so en; and, error control code. Again as noted above, the 
selection of the particular data and the manner in 
which its processed and organized is subject to meet- 
ing the requirements of the particular system in- 
volved. A mailing run identifier for the particular mail 

55 run may also be included. 

The above process continues until it is deter- 
mined at 728 that there are no more records in the 
postal revenue blockf ile to be processed. At this time. 
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at 750, the postal revenue block file, corrected ad- 
dress file, bad address file and accounting record are 
encrypted and at 752 transmitted to the mailer. A copy 
of the message transmitted to the mailer is stored at 
the data center for later possible retransmission 5 
and/or statistical analysis and/or later audit. Depend- 
ing on the requirements of the system the storage can 
be temporary and/or permanent 

Reference is now made to FIGURE 8 which is a 
flow chart of the verification process for the verifies- 10 
tion authority system shown in FIGURE 5. Each re- 
ceived mailpiece is scanned at 802 for address and 
postal revenue block data. The scanning can be done 
by any suitable means. Examples of suitable scan- 
ning systems include hand held scanners and fixed is 
high speed scanners typically employed by postal 
processing equipment The scanning can be of alpha- 
numeric data or barcode or other coded printed data 
depending upon the particular system employed and 
the requirements of the system. The scanning may be 20 
performed by a person reading the data on the envel- 
ope and keying it in through a user interface at 504. 

The outcome of the scanning at 802 may be an 
ASCII file, of processible data to be thereafter util- 
ized. Adetermination is made at 804 as to whether the 25 
error correction code appended as shown in FIGURE 
7 is correct. If it is correct, a determination is made at 
806 of the postal service key from the vendor identi- 
fication and the mailer identification numbers. There- 
after, a digital token is generated with the postal ser- 30 
vice key at 808 and a comparison is made at 810 be- 
tween the postal service digital token printed on the 
mailpiece with the previously generated digital token 
at 808. The vendor token can be processed in similar 
manner. Depending on the system, decryption tech- 35 
niques, rather than reencryption techniques may be 
employed if desired. Adetermination is made at 812 
whether the comparison of the postal service digital 
token read from the mailpiece and the one generated 
at 808 compared correctly. If matched, the process 40 
continues. It may be desired however at 814 to ran- 
domly, or based on other criteria, as for example, level 
of usage of a particular mailer, destination, density for 
mailpieces and the like, or profile of the mailer, select 
mailpieces for vendor verification by comparing the 45 
vendor digital token with the vendor digital token print- 
ed on the mailpiece. If it is determined at 812 that a 
match did not occur, the mailpiece is outsorted for 
manual inspection at816. It should be recognized first 
if at 804 the error correction code did not verify as cor- so 
rect the process may either be stopped or a manual 
inspection may be conducted at 818. The vendor dig- 
ital token may be also processed in a similar manner. 

As previously noted, an alternate embodiment of 
the metering system shown and described in connec- 55 
tion with FIGURES 1 and 3 through 7 is shown in con- 
nection with FIGURE 9 through 14. This embodiment 
in FIGURES 9 through 14 is suitable for use in a net- 
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work environment. To a large extent similar reference 
numerals are used (other than the first digit for FIG- 
URES 1 through 9 and the first two digits for FIGURES 
9 through 14) in FIGURES 9 through 14 to designate 
similar system elements as designated in FIGURES 
1 and 3 through 7. The similar structure operates in 
a similar manner and will not be described again in 
detail. 

Reference is made to FIGURE 9. The division of 
function between the mailer unit 912 and data center 
910 is modified since the digital tokens are now gen- 
erated at the mailer facility. Thus, the functions of up- 
dating the data repository and the new function of up- 
loading the data repository information are incorpo- 
rated in the mailer unit 912 as well as cleansing the 
mailing list and generating the postage revenue block 
file. The function in the mailer unit of encrypting and 
sending the postal revenue request file to the data 
center is no longer required and has been eliminated. 
This is because, as will be apparent in FIGURE 10, a 
secure postage evidencing device is provided at the 
mailer facility on the mailer network. Encryption, 
however, if desired can still be employed for commu- 
nications on the mailer network as an option to the 
mailer for security purpose. 

Reference is made to FIGURE 10 which is a dia- 
grammatic representation of a mailer unit coupled to 
a network system along with the other necessary 
components for metering postage. The mailer unit 
1002 is connected through a communications port 
1028 to a mailer network 1030. The mailer network 
1030 may be a local area network. It may be a wire- 
less or a wired network, it may be a telephone net- 
work or other suitable communication system to allow 
communication between the various mailer compo- 
nents. 

Connected to the mailer network are a postal evi- 
dencing device shown generally at 1032 and an ad- 
dress hygiene server or device shown generally at 
1034 these devices 1032 and 1034 function to pro- 
vide the necessary functions of the data center 
shown in FIGURE 4; however, the secure postage 
evidencing functions are embodied in the postage 
evidencing device 1032 while the address hygiene 
functions are embodied in the device 1034. The ad- 
dress hygiene functions of device 1034, may be, if de- 
sired, incorporated in the postage evidencing device 
1 032 or in the mailer unit 1 002 or even left at the data 
center or another remote facility. 

The postage evidencing device 1032 includes a 
data communications system 1036 connected to a 
data storage device 1038 which includes various in- 
formation in addition to information received from the 
mailer unit 1002 over the network 1030. Included in 
the storage device 1 038 are: vendor and postal secret 
key information; data repository which would include 
information transmitted by the mailer unit 1002; and, 
mailer account information which may also include in- 
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formation transmitted by the mailer and serial num- 
ber. The data repository and mailer account informa- 
tion may include, similar to FIGURE 4 accumulated 
data and other data stored by the data center relevant 
to various transactions associated with the mailer. 
The memory 1038 is a secure tamper resistant mem- 
ory and the entire postage evidencing device may be 
secured in a separate secure location within the mai- 
ler facility or to a remote mailer facility on the mailer 
network. 

A digital token transformation processing device 
1040 is provided. The data from the memory 1038 
along with appropriate data from the mailer unit 1 002 
and the and/or the address hygiened server 1 034, are 
processed in the digital token transformation proc- 
essing device 1040. The digital tokens are communi- 
cated via a communication port 1042 in the data com- 
munication system to the mailer unit 1002 to be util- 
ized in the manner previously described. The network 
secure memory device 1038 contains the vendor se- 
cret key and the Post Office secret key assigned to 
the network postage evidencing device 1032 for pro- 
duction of digital tokens. There is not Post Office se- 
curity device in the network system corresponding to 
data center Post Office security device 420 in FIG- 
URE 4. In the case of the data center system, the data 
center contains sufficient information for a forger to 
imitate all mailers using the data center, and thus it is 
important for the Post Office to maintain security in- 
dependent of the vendor to assure the integrity of the 
system. In the case of the network system the post- 
age evidencing device contains only sufficient infor- 
mation to imitate itself, and so there is no advantage 
significant to maintaining the vendor secret key and 
the Post Office secret key in separate secure devic- 
es. 

The address hygiene server 1034 includes a 
memory 1048 having the postal address database 
stored therein. The storage device 1048 is connected 
through the communication port 1052 of the data 
communications system 1050 to the network 1030. 
The address information is received via the network 
and the communication port 1052 which is thereafter 
flowed into the memory 1 048 for processing in the ad- 
dress hygiene process device 1054. Hygiened ad- 
dress information is communicated via the communi- 
cation port 1 052 and the network 1 030 to the postage 
evidencing device 1038 and to mailer unit 1002. 

Reference is now made to FIGURE 11 which is 
the diagrammatic representation of the data center 
suitable for operation with the mailer unit and the net- 
work arrangement shown in FIGURE 10. Data center 
shown generally at 1102 includes a memory 1104 
containing the national change of address database 
and the data repository. The memory 1104 is con- 
nected to the mailer unit 1 002 via a data communica- 
tion system 1006 having a communication port of 
1108. The memory 1104 includes the information 



which is uploaded to the mailer facility 912. The data 
center may include an electronic funds system 1110 
which functions similarly to the electronic funds 
transfer system 518 shown in FIGURE 5. This is to de- 

5 note that the electronic funds transfer system may be 
part of the data center as opposed to or in addition to 
the post office system. Thus, where the electronic 
funds accounting and transfer occurs at the data cen- 
ter, this information is communicated to the mailer 

10 and to the post off ice. When as in FIGURE 5, the elec- 
tronic funds system is at the post office, the account- 
ing information is communicated from the post office 
to the mailer through the data center. 

A secure memory 1112 is also provided at the 

15 data center 1102. The secure memory stores vendor 
authentication code; vendor secret key information; 
and postal secret key information, if desired. The se- 
cure memory 1112 may be a portion of the memory 
1104 or a separate secure memory in a tamper resis- 

20 tant housing. 

Reference is now made to FIGURE 12 which is a 
diagrammatic representation of a post office system 
suitable for work with the network arrangement The 
post office 1202 includes a memory 1212 containing 

25 the data repository and verification reports. Addition- 
ally stored, if desired, is of the additional information 
shown in the memory 512 of FIGURE 5. However, the 
postal address database and national change of ad- 
dress database can be stored if desired, at the ad- 

30 dress hygiened server 1034 or at the data center 
1102. The post office system shown in FIGURE 12 
functions in the same manner as that shown in FIG- 
URE 5 to authenticate and verify payment of postage 
for various mailpieces delivered by mailers to the post 

35 office. 

Reference is now made to FIGURE 13. As can be 
seen by a comparison of FIGURE 13 AND FIGURE 6, 
the flow of the operation of the mailer facility is very 
similar to the mailer unit; however, communication is 

40 established with the network postage evidencing sys- 
tem at 1 308 and the postage evidencing system func- 
tions in much the same way as the data center func- 
tions in the non network system shown in FIGURES 
1 through 8. 

45 Reference is now made to FIGURE 14. As can be 

seen by a similar comparison of FIGURE 13 and FIG- 
URE 7, the postage evidencing system on the net- 
work processes requests in a similar manner as the 
data center shown in FIGURE 7 processes requests. 

so The functionality, however, is divided between ad- 
dress hygiene server 1034 and the postage evidenc- 
ing device 1032. 

It should be noted that the above described sys- 
tem provides numerous benefits to the mailer, the 

55 data center and the post office. The benefits include: 
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For the mailer: 

1) Accurate funds tracking for multiple accounts. 

2) Automatic access to centralized address infor- 
mation, including frequently updated change of 5 
address information. 

3) A majority of communication between mailer, 
data center and a carrier can be made totally 
transparent to communicating parties by employ- 
ing electronic data interchange methods. 10 

4) Confidentiality and authenticity of all sensitive 
information can be protected. 

5) Alow cost effective mailpiece preparation sol- 
ution for mailer is provided. 

6) Convenient access to postage payment is pro- 15 
vided. 

7) The data center may provide for additional in- 
formation or control of job run and other sched- 
uling for optimization of delivery time and mailing 
costs based on postal network information. 20 

8) The data center can provide various different 
and/or similar services through alternative carri- 
ers for special services and packages. 

9) The data center can provide customized mail- 
ing lists both nationally and internationally based 25 
on market demographics. 

10) Data Center can provide distributed hybrid 
mail the data center may also be a mail center 
which can generate the physical mail for the mai- 
ler, close to physical delivery addresses. 30 

11) The systems conform to and are compatible 
with computer networked based business opera- 
tions. 

12) Asingle device solution is provided for a mai- 
ler's facility using local area network arrange- 35 
ments such as, for example campus, metropoli- 
tan area, geographic area or company using cor- 
porate or other network arrangements. 

For the Data Center: 40 

1) Secret encryption key management is much 
more effective. 

2) Access is provided to customers mailings for 
marketing and usage information. 45 

3) Ability is provided to to monitor mailing fre- 
quency and geographic distribution. 

4) The data center can provide evidence of au- 
thenticity of payment or data for other applica- 
tions. 50 

5) Asingle point of contact is provided for distrib- 
ution services to mailer. 

6) data repositories. 

For the Post Office (or other carrier) : 55 

1) High quality addresses give mail is generated 
which is suitable for automated processing from 



small and intermediate size mailers. The cost of 
mail distribution is therefor reduced. 

2) The quality of information for verification is 
much higher. 

3) The postal service burden for implementation 
may be minimal and is facilitated. The format of 
all communications between vendor and post of- 
fice are predefined by the interface. 

4) Access to summary information of system use 
provides a guide for sampling and verification. 

5) A way is enabled to provide special discounts 
and customized rates for mailers. 

6) A natural and significantly simplified way is en- 
abled to provide special services such as certi- 
fied, registered, international and overnight mail 
for mailers. 

6) Provides a planning tool for new services and 
facilities for small and medium size mailers. 
It should be recognized that some of the benefits 
are more particularly found in the network embodi- 
ments disclosed above as opposed to the non-net- 
work embodiments. Specifically, the network post- 
age evidencing device systems described may, in 
certain instances be better suited to particular mailing 
applications as opposed to the non-network systems. 
For example, the non-local area network system may 
be better suited to fit batch mailers will regular plan- 
ned mailings who wish to directly interact with a cen- 
tral data center and/or post office and/or carrier, rath- 
er than conduct internal accounting. On the other 
hand, the network avoids the need to provide mo- 
dems and telephone lines for each mail generation 
station or for multiple mail generation stations. More- 
over, access to an electric data interchange may be 
expensive. 

Telephone line charges may have a fixed cost 
that would be shared over the total number of tokens 
processed for a small number of digital tokens, this 
may be expensive. The network systems and method 
on the other hand, may best fit businesses with less 
periodic smaller mailings or several mail generation 
stations. Other consideration include that computer 
networks can provide a direct high-speed link to a 
network postage evidencing device for mail genera- 
tion stations. The cost of network attachment would 
be shared with all other network based activities. Net- 
work devices, in certain situations, may better fit high 
volume mailers with large token processing require- 
ments. An additional factor that may involve the se- 
lection and design of the particular system, is the 
bandwith of the system itself or the communication 
requirements which may include issues such as, per- 
formance requirements and centralized distribution 
at the mailers site. 

It should be recognized that all of the above fac- 
tors are simply considerations which may cause an 
individual mailer to select one particular approach 
over another. However, either approach would be sat- 
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isfactory to solve any mailer requirements and may 
be dictated by external factors such as requirements 
of the carrier service involved and the availability of 
hardware, communications, and software. 

White the present invention has been described 
with reference to the specific embodiments, it is ap- 
parent that many variations and modifications may be 
made to these various embodiments. It is thus intend- 
ed in the following claims to cover each variation and 
modification that falls within the true spirit and scope 
within the present invention. 



Claims 

1. A method for preparing mailpiece comprising the 
steps of: 

creating a mailing list for a plurality of mail- 
pieces, said mailing list including mailpiece reci- 
pient address information for each mailpiece of 
said plurality of mail pieces, said mailing list in- 
cluding correct recipient address information and 
incorrect recipient address information; 

transmitting said mailing list to a data cen- 
ter; and, 

receiving from said data center a mailing 
list including address hygiened recipient address 
information for mail pieces in said transmitted 
mailing list with incorrect recipient address infor- 
mation and a digital token for each mail piece of 
said plurality of mail pieces, each of said digital 
tokens including encrypted information for each 
mail piece of said plurality of mail pieces based 
on said correct address information for mail 
pieces with correct address information on said 
transmitted mailing list and on hygiened recipient 
address information for mail pieces with incorrect 
recipient address information on said transmitted 
mailing list 

2. A method as defined in CLAIM 1 further compris- 
ing: 

printing said mail pieces with said correct 
recipient address information, said hygiened re- 
cipient address information and said digital tok- 
ens. 

3. A method as defined in CLAIM 1 or 2 further com- 
prising: 

encrypting said mailing list for transmis- 
sion to said data center and wherein said trans- 
mitted mailing list is said encrypted mailing list 

4. A method as defined in any preceding claim fur- 
ther comprising: 

said mailing list received from said data 
center being an encrypted mailing list with said 
hygiened recipient address information encrypt- 



ed and said digital token further encrypted; and, 
decrypting said received mailing list to ob- 
tain unencrypted hygiened recipient address in- 
formation for incorrectly addressed mail pieces of 

5 said plurality of mail pieces and said digital tok- 

ens including encrypted information based on 
said correct address information for mail pieces 
with correct address information on said trans- 
mitted mailing list and on hygiened recipient ad- 

w dress information for mail pieces with incorrect 

recipient address information on said transmitted 
mailing list. 

5. A method as defined in any preceding claim fur- 

15 ther comprising: 

encrypting said mailing list for transmis- 
sion to said data center and wherein said trans- 
mitted mailing list is said encrypted mailing list; 
said mailing list received from said data 

20 center being an encrypted mailing list with said 

hygiened recipient address information encrypt- 
ed and said digital token further encrypted; and, 
decrypting said received mailing list to ob- 
tain unencrypted hygiened recipient address in- 

25 formation for incorrectly addressed mail pieces of 

said plurality of mail pieces and said digital tok- 
ens including encrypted information based on 
said correct address information for mail pieces 
with correct address information on said trans- 

30 mitted mailing list and on hygiened recipient ad- 

dress information for mail pieces with incorrect 
recipient address information on said transmitted 
mailing list. 

35 6. A method as defined in any preceding claim fur- 
ther comprising printing said recipient address in- 
formation in machine readable format on said 
mail piece. 

40 7. A method as defined in any preceding claim fur- 
ther comprising receiving said transmitted mail- 
ing list at said data center and accounting for the 
value authenticatable by the digital tokens. 

45 8. A method as defined in any preceding claim fur- 
ther including the steps of monitoring digital token 
use and 

where the digital token is not utilized, 
transmitting to said data center information con- 
50 cerning said digital tokens not utilized. 

9. A method as defined in CLAIM 8 further compris- 
ing storing at said data center information con- 
cerning digital tokens for each mailing list and 
55 also storing at said data center information con- 

cerning said transmitted information concerning 
said digital tokens not utilized. 

13 
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1 0. A method as defined in CLAIM 9 further compris- 
ing accounting at the data center for digital tokens 
provided for each mailing list 

11. A method as defined in CLAIM 10 further com- 
prising accounting for said digital tokens not util- 
ized. 

12. A method as defined in any preceding claim fur- 
ther comprising maintaining at said data center a 
repository of data regarding each mailing list and 
the particular mailer associated with generating 
the mailing list 

1 3. A method as defined in CLAIM 8 further compris- 
ing storing at a mailer facility associated with the 
generation of the mailing list said information 
concerning digital tokens for each mailing list and 
also storing at the data center said information 
concerning said digital tokens not utilized. 

14. A method as defined in any preceding claim 
wherein said mailing list includes mail pieces with 
recipient address information not susceptible to 
address hygiene and further comprising receiv- 
ing address identifier data for such mail pieces. 

15. A method as defined in any preceding claim 
wherein said mailing list includes mail pieces with 
recipient address information not susceptible to 
address hygiene and further comprising receiv- 
ing a recipient address mail piece identifier for 
each such mail piece said digital token for each 
such mail piece based on said identifier data. 

16. A method for preparing mail pieces comprising 
the steps of: 

creating a mailing list for a plurality of mail 
pieces, said mailing list including mail piece reci- 
pient address information for each mail piece of 
said plurality of mail pieces, said mailing list in- 
cluding correct recipient address information and 
incorrect recipient address information; 

determining rating parameter information 
for each of mail pieces of said plurality of mail 
pieces, said rating parameter information consti- 
tuting the basis upon which the charges for mail 
piece delivery is calculated; 

transmitting said mailing list and said rat- 
ing parameter information to a data center; and, 

receiving from said data center a mailing 
list including address hygiened recipient address 
information for mail pieces in said transmitted 
mailing list with incorrect recipient address infor- 
mation and a digital token for each mail piece of 
said plurality of mail pieces, each of said digital 
tokens including encrypted information encrypt- 
ed information for each mail piece of said plurality 



of mail pieces based on both the rating parameter 
information and said correct address information 
for mail pieces with correct address information 
on said transmitted mailing list and on hygiened 
5 recipient address information for mail pieces with 

incorrect recipient address information on said 
transmitted mailing list 

17. A method for preparing mail pieces comprising 
10 the steps of: 

creating a mailing list for a plurality of mail 
pieces, said mailing list including mail piece reci- 
pient address information for each mail piece of 
said plurality of mail pieces, said mailing list in- 

15 eluding correct recipient address information and 

incorrect recipient address information; 

determining rating parameter information 
for each of mail pieces of said plurality of mail 
pieces, said rating parameter information consti- 

20 tuting the basts upon which the charges for mail 

piece delivery is calculated; 

transmitting said mailing list and said rat- 
ing parameter information to a data center; and, 
receiving from said data center a mailing 

25 list including corrected recipient address informa- 

tion for mail pieces in said transmitted mail list 
with incorrect recipient address information and 
information representative of postal charges for 
said plurality of mail pieces, the representative in- 

30 formation being based on the rating parameter in- 

formation and said correct address information 
for mail pieces with correct address information 
on said transmitted mailing list, and on the rating 
parameter information and recipient address in- 

35 formation for mail pieces with incorrect recipient 

address information on said transmitted mailing 
list. 

1 8. A method as defined in CLAIM 1 7 wherein said in- 
40 formation representative of postal charges for 

said plurality of mail pieces is authenticated infor- 
mation. 

19. A method as defined in CLAIM 18 wherein said 
45 authenticated information has been authenticat- 
ed by a carrier service to whom said postal charg- 
es are to be paid. 
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(57) Methods and systems for preparing mail- 
pieces involve the creation of mailing lists 
which includes correct and incorrect recipient 
address information. The list is transmitted to a 
data center (116). Received from the data center 
(116) is a mailing list including addressed 
hygiened recipient address information and a 
digital token for each mail piece with encrypted 
data. The encrypted data is based on the correc- 
ted address information for mail pieces (122) 
with correct address information on the trans- 
mitted mailing list and on hygiened recipient 
address information on the mailpieces (122) 
with incorrect recipient address information on 
the transmitted mailing list The digital tokens 
for each mail piece may also be based on the 
rating parameter information. 

Selection is provided for utilizing a given one 
of the incorrect recipient address information 
and the correct recipient address information is 
applied to an encrypter generating the digital 
tokens. The encrypting means for generating 
digital tokens may be located remote from the 
mailer facility or on a mailer facility or other 
local area network. Various arrangements are 
employed in generating and printing digital to- 
kens recipient address information and correc- 
ted recipient address information. 
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